Privacy Policy

1. Data Controller

Wood-Deal ("we", "us", "our") is operated by Vive Future, a company registered in Poland. We operate the website wood-deal.com and the associated B2B biomass marketplace platform. We are the data controller responsible for your personal data in accordance with the General Data Protection Regulation (GDPR, EU 2016/679).

Contact: privacy@wood-deal.com

2. Data We Collect

We collect the following categories of personal data:

• Account data: first name, last name, email address, phone number, hashed password.
• Company data: company name, VAT number, country, region, address, description, logo, banner images.
• Usage data: listings created, buy requests, messages sent through leads, negotiation history.
• Technical data: IP address, browser type, access timestamps, cookies (httpOnly session token).
• Documents: files you upload (certifications, photos, documents) stored in our secure storage.
• Google account data (optional): if you sign in with Google, we receive your Google email, name, and Google user ID.

3. Legal Basis for Processing

• Contract performance (Art. 6(1)(b) GDPR): processing necessary to provide the marketplace service you registered for.
• Consent (Art. 6(1)(a) GDPR): for optional features such as email notifications and marketing.
• Legitimate interest (Art. 6(1)(f) GDPR): fraud prevention, security monitoring, service improvement.
• Legal obligation (Art. 6(1)(c) GDPR): where required by applicable law.

4. How We Use Your Data

• To create and maintain your account and company profile.
• To display your listings and buy requests on the marketplace.
• To facilitate communication between buyers and sellers through leads/messages.
• To send transactional emails (verification codes, deal notifications).
• To prevent abuse via rate limiting and IP logging.
• To generate anonymized analytics and price snapshots for market transparency.

5. Data Sharing

We do not sell your personal data. We share data only with:

• Other platform users: your company name, listings, and contact information are visible to registered users according to the platform's access tiers.
• Service providers: Supabase (database & storage hosting), Vercel (frontend hosting), Railway (backend hosting), Resend (transactional email), Google (Maps API, OAuth).
• Legal authorities: when required by law or to protect our rights.

6. Data Storage & Security

Your data is stored on servers located within the European Union (Supabase EU region). We employ industry-standard security measures including:

• Encrypted connections (HTTPS/TLS) for all data in transit.
• Passwords hashed with bcrypt (12 rounds).
• HttpOnly, Secure cookies for authentication tokens.
• Row Level Security (RLS) on all database tables.
• Rate limiting on sensitive endpoints.

7. Data Retention

We retain your personal data for as long as your account is active. If you delete your account, we will delete or anonymize your personal data within 30 days, except where retention is required by law (e.g., audit logs may be retained for up to 12 months).

8. Your Rights (GDPR)

Under the GDPR, you have the right to:

• Access: request a copy of your personal data.
• Rectification: correct inaccurate or incomplete data.
• Erasure: request deletion of your data ("right to be forgotten").
• Restriction: request restriction of processing.
• Portability: receive your data in a structured, machine-readable format.
• Objection: object to processing based on legitimate interests.
• Withdraw consent: at any time, without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at privacy@wood-deal.com. We will respond within 30 days.

9. Cookies and Similar Technologies

Strictly necessary. We use one essential httpOnly cookie (wood-deal-token) for session authentication. It is required for the service to function and does not require consent under GDPR. Your cookie choice itself is stored in your browser's local storage so we can respect it on future visits.

Analytics (only with your consent). We use Google Analytics 4 to measure how the website is used (pages visited, traffic sources, aggregated usage). Analytics cookies are set only if you accept the "Analytics" category. Google Consent Mode is configured with all storage denied by default; if you do not consent, Google Analytics does not set cookies and only receives cookieless consent signals (pings without a persistent identifier).

Marketing (only with your consent). We use the Meta Pixel(Facebook/Instagram) to measure the performance of our campaigns and to reach people who visited wood-deal.com. The Meta Pixel script is not loaded at all unless you accept the "Marketing" category; with your consent, Meta Platforms Ireland Ltd. may set cookies and receive information about your visit (such as pages viewed and your IP address). Please refer to Meta's data policy for how Meta processes this data.

Your choice. On your first visit a cookie banner lets you accept all, reject all, or configure each category separately. Rejecting non-essential cookies does not limit your use of the marketplace. You can change or withdraw your choice at any time via the "Cookies" link in the website footer; withdrawal takes effect for future processing and does not affect the lawfulness of processing carried out before it. The legal basis for analytics and marketing cookies is your consent (Art. 6(1)(a) GDPR).

10. International Data Transfers

Some of our third-party service providers are located outside the European Economic Area (EEA). Specifically, Google (Maps API and OAuth) may process data in the United States. We ensure adequate protection through Standard Contractual Clauses (SCCs) approved by the European Commission under Article 46(2)(c) GDPR, the EU–U.S. Data Privacy Framework, and adequacy decisions under Article 45 GDPR. You may request a copy of applicable safeguards at privacy@wood-deal.com.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes via email. The "Last updated" date at the top of this page indicates the latest revision.

12. Contact & Complaints

If you have questions about this Privacy Policy or wish to file a complaint, contact us at privacy@wood-deal.com. You also have the right to lodge a complaint with your local data protection authority.